Clear answers to real GDPR, cyber, & governance questions.

Practical, plain‑English explanations for boards, trustees, leaders, & teams responsible for protecting personal data.

Organisations don’t fail to comply with the GDPR because they don’t care, they fail because accountability, decisions, and evidence are unclear.

This hub provides direct answers to the questions decision‑makers actually ask, based on real regulatory expectations and operational reality.

How to use these answers

• Each page answers one specific question
• Written for non-specialists and decision-makers
• Designed to be quoted, shared, and relied upon

Answer collections

Board & Trustee answers

Oversight, accountability, assurance

• What should a board do after a data breach?
• Who is accountable for GDPR compliance at board level?
• What should trustees see in a GDPR risk report?
• How can boards get assurance over data protection risk?
• What does good GDPR governance look like?

Legal & DPO answers

Defensibility, independence, regulatory scrutiny

• What does a DPO actually do in practice?
• Who decides if a data breach is reportable?
• What evidence do regulators expect?
• When should an organisation appoint a DPO?

IT & Cyber Security answers

Incidents, controls, and response

• When does a cyber incident become a data breach?
• How should IT teams prepare for GDPR incidents?
• How does cyber security support GDPR compliance?

These answers reflect:

• UK GDPR expectations
• Regulator‑tested practices
• Board‑level accountability standards

They are written to explain what good looks like, not to sell software.